What is the CVSS score of CVE-2026-2093?

CVE-2026-2093 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-2093?

Within 24 hours: Identify all systems running Docpedia and isolate them from production networks or disable external access; notify the security team and document affected systems. Within 7 days: Implement WAF rules to block SQL injection patterns; enable database activity monitoring; conduct a preliminary audit of database access logs for signs of exploitation. Within 30 days: Contact Flowring for patch timeline; evaluate alternative solutions; perform forensic analysis if compromise is suspected; implement network segmentation to restrict Docpedia access to authorized users only.

CVE-2026-2093

HIGH

SQL Injection (CWE-89)

2026-02-10 twcert@cert.org.tw

SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 07:16 nvd

HIGH 7.5

DescriptionCVE.org

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

AnalysisAI

Unauthenticated attackers can exploit SQL injection in Flowring's Docpedia to execute arbitrary database queries and extract sensitive information without authentication. The vulnerability requires no user interaction and is remotely accessible over the network, presenting a critical risk to all deployments. No patch is currently available to remediate this issue.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

Affected ProductsAI

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read d

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.